To understand why setting \(P^A_X\ne P^B_X\)  is helpful in the case of Bob's receiver being fixed, consider the sifting stage. Before sifting, Alice and Bob shared \(N\)  bits. The fraction of these bits discarded in the sifting stage is \(P^A_X P^B_Z+P^A_Z P^B_X\) . The fraction of bits retained in the \(X\)  basis is \(P^A_X P^B_X\) , while \(P^A_Z P^B_Z\)  is the fraction in the \(Z\)  basis. To maximize the key length, we want \(P^A_X P^B_X\)  close to one, while still allowing enough bits in the \(Z\)  basis to accurately estimate the parameters. If \(P^B_X\)  is fixed and \(P^A_X=P^B_X\) , we have no control of the sifting ratios. We thus generalize the protocol by allowing Alice and Bob to have different basis choice probabilities. This change in the protocol affects the numbers \(n_{X(Z),k}\)  and \(m_{X(Z),k}\)  seen in a given run. The change, however, does not affect either the key length formula, (REF ), or crucially, the security analysis [1]}, [2]}.
